Firefox 2.0.0.12 Security Release 火狐2.0.0.12安全释放

Firefox 2.0.0.12 Security Update fixes 7 Vulnerability & 3 critical patch (memory corruption, JavaScript Engine Crashes ). 火狐2.0.0.12安全更新修复7漏洞和3关键补丁 （内存腐败， JavaScript引擎崩溃 ） 。

Known Vulnerabilities in Mozilla Products (Firefox 2.0.0.11)已知弱点在Mozilla产品（火狐2.0.0.11 ）

MFSA 2008-11 金融事务局2008-11

Web forgery overwrite with div overlay伪造网站与区覆盖重叠

Descriptions说明

Security researchers Emil Ljungdahl and Lars-Olof Moilanen demonstrated that, in cases where the entire contents of a page are enclosed in a <div> with absolute positioning, a web forgery warning dialog won’t be displayed unless the user switches tabs away-from then back-to the forgery page.安全研究人员埃米尔Ljungdahl和拉尔斯-奥洛夫帕Moilanen表明，如果整个内容的网页是在一个封闭的<div>绝对定位，伪造网页警告对话框不会显示，除非用户交换机的标签以外，从然后返回伪造网页。

References参考文献

• Web forgery warning not shown until tab switch 伪造网页不会显示警告直至标签切换
• National Vulnerability Database (NVD) - CVE-2008-0594 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 594

MFSA 2008-10 2008-2010年金融事务局

URL token stealing via stylesheet redirect网址令牌通过样式偷重定向

Descriptions说明

Security researcher Martin Straka reported that Gecko-based browsers update the .href property of stylesheet DOM nodes to reflect the final URI of the stylesheet after following any 302 redirects (much as the document.location property is updated).安全研究员马丁Straka报告说， 基于Gecko的浏览器更新。 href财产样式的DOM节点，以反映最终的URI样式的后任何302重定向（相当于document.location财产的更新） 。 This differs from other browsers and could potentially reveal sensitive URL parameters, such as those used by Single-signon sytems, to scripts on the page.这不同于其他的浏览器，并有可能揭示敏感的参数，如所用的单登录sytems ，以文字在网页上。

References参考文献

• Stylesheet href property shows redirected URL unlike other browsers 样式href财产显示重定向的URL不像其他浏览器
• National Vulnerability Database (NVD) - CVE-2008-0593 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 593

MFSA 2008-09 金融事务局2008-09

Mishandling of locally-saved plain text files处理不当的地方保存纯文本文件

Descriptions说明

Mozilla contributor oo.rio.oo demonstrated that once a file with Content-Disposition: attachment and (improper) Content-Type: plain/text is saved locally, the browser would no longer open local files with .txt extensions for viewing, but would rather prompt the user to save the file. Mozilla的贡献者oo.rio.oo表明，一旦一个文件， 内容配置：依恋和（不当） 内容类型：平原/文字保存在当地，浏览器将不再开放当地的档案。文本扩展观看，但会而提示用户保存文件。

References参考文献

• plain text txt file viewing capability lost after having downloaded a txt file with content-disposition: attachment and content-type: plain/text 纯文字txt文件查看功能丧失后，下载了txt文件的内容处置：查封和内容类型：纯/文
• National Vulnerability Database (NVD) - CVE-2008-0592 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 592

MFSA 2008-08 金融事务局2008-08

File action dialog tampering文件对话框篡改行动

Descriptions说明

Security researcher Michal Zalewski demonstrated that timer-enabled security dialogs can be subverted by attackers using JavaScript to change the window focus.安全研究人员Michal 扎莱夫斯基表明，计时器启用安全对话可以破坏攻击者利用JavaScript来改变窗口的重点。 Zalewski showed that a user could be tricked into confirming a security dialog of this type by bringing the dialog back into focus right before a user clicked in a predictable time and place.扎莱夫斯基表明，一个用户可能被诱骗到证实了安全对话这种类型的对话将集中到前一个用户点击一个可预见的时间和地点。

References参考文献

• file action dialog controls vulnerable to refocus race 文件的行动控制脆弱的对话，重新比赛
• National Vulnerability Database (NVD) - CVE-2008-0591 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 591

MFSA 2008-06 金融事务局2008-06

Web browsing history and forward navigation stealing Web浏览器的历史和前瞻性导航偷窃

Descriptions说明

Mozilla contributor David Bloom reported a vulnerability in the way images are treated by the browser when a user leaves a page which utilizes designMode frames. Mozilla的贡献者大卫方坯报告中的一个安全漏洞的方式处理图像时由浏览器的用户留下了网页，其中利用designMode框架。 The reported issue can be used to steal a user’s navigation history, forward navigation information, and crash the user’s browser.报告的问题都可以用来窃取用户的航海史上，前瞻性的导航信息，和系统崩溃用户的浏览器。 The crash showed evidence of memory corruption and might be exploitable to run arbitrary code.飞机坠毁的证据显示，腐败和记忆可能会利用运行任意代码。

References参考文献

• Vulnerability allows script to see where user is headed, sniff history, and crash [@ nsDocShell::Destroy()] the browser too 漏洞允许脚本来看看用户是领导，嗅出历史，坠毁[ @ nsDocShell ： ：破坏（ ） ]太多的浏览器
• National Vulnerability Database (NVD) - CVE-2008-0419 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 419

MFSA 2008-05 金融事务局2008-05

Directory traversal via chrome: URI通过目录遍历铬：网址

Descriptions说明

Gerry Eisenhaur reported the chrome: URI scheme improperly allowed directory traversal that could be used to load JavaScript, images, and stylesheets from local files in known locations. 格里Eisenhaur铬报告：计划不当的URI目录遍历允许可以用来加载JavaScript ，图片和样式从本地文件在已知的地点。 This traversal was possible only when the browser had installed add-ons which used “flat” packaging rather than the more popular .jar packaging, and the attacker would need to target that specific add-on.这是可能的遍历只有当浏览器安装了插件使用“平面”的包装，而不是更受欢迎。罐包装，攻击者需要针对特定的插件。

Mozilla researcher moz_bug_r_a4 reported that this vulnerability could be used to steal the contents of the browser’s sessionstore.js file, which contains session cookie data and information about currently open web pages. Mozilla基金会研究员moz_bug_r_a4报告说，这个安全漏洞可能被用来窃取的内容浏览器的sessionstore.js文件，其中载有会话cookie数据和资料，对当前打开的网页中。

References参考文献

• Allows to steal data from sessionstore.js 允许窃取数据从sessionstore.js
• chrome directory traversal (local disk access via “flat” addons) 铬目录遍历（本地磁盘可以通过“平面” ，大家一起来！ ）
• list of “flat” packaged add-ons 清单“平面”打包插件
• National Vulnerability Database (NVD) - CVE-2008-0418 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 418

MFSA 2008-04 金融事务局2008-04

Stored password corruption储存的密码腐败

Descriptions说明

Mozilla developer Justin Dolske discovered that malicious sites, upon a user saving his or her password, could inject newlines into Firefox’s password store and corrupt saved passwords for other sites. Mozilla的开发者贾斯汀Dolske发现恶意网站时，用户节省他或她的密码，可以注入换行符到Firefox的密码存储和腐败保存的密码，其他网站。

References参考文献

• Content can corrupt stored passwords by injecting line breaks 腐败的内容可以存储的密码注射换行符
• National Vulnerability Database (NVD) - CVE-2008-0417 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 417

MFSA 2008-03 金融事务局2008-03

Privilege escalation, XSS, Remote Code Execution特权升级， XSS错误，远程代码执行

Descriptions说明

Mozilla contributors moz_bug_r_a4 and Boris Zbarsky submitted a series of vulnerabilities which allow scripts from page content to escape from its sandboxed context and/or run with chrome privileges. Mozilla的贡献者moz_bug_r_a4 和鲍里斯Zbarsky提交了一系列的漏洞，使脚本的网页内容，以摆脱其sandboxed背景和/或运行铬特权。 An additional vulnerability reported by moz_bug_r_a4 demonstrated that the XMLDocument.load() function can be used to inject script into another site, violating the browser’s same-origin policy.另外一个漏洞moz_bug_r_a4报告表明， XMLDocument.load （ ）函数可用于脚本注入到另一地点，违反了浏览器的同一原产地的政策。

References参考文献

• List of JavaScript privilege escalation bugs 列表的JavaScript权限升级漏洞
• National Vulnerability Database (NVD) - CVE-2008-0415 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 415

MFSA 2008-02 金融事务局2008-02

Multiple file input focus stealing vulnerabilities多文件输入重点盗窃漏洞

Descriptions说明

Security researchers hong and Gregory Fleisher each reported a variant on earlier reported bugs regarding focus shifting in file input controls.安全研究人员和格里高利红弗莱舍每个报告的一个变种早先报告的错误就重点转向档案输入控制。 Their variants used file input controls nested inside <label> tags to take advantage of automatic focus shifting into the file input field noted on the Hacker WebZine.及其变种使用档案输入控制嵌套在<label>标签，以充分利用自动对焦转移到文件输入字段指出的黑客网页。 As with the earlier reported issues this issue could be used to force a user to upload arbitrary files assuming the attacker knows the full path and name of the file.正如此前报道的问题这个问题可以用来强制用户上传任意文件假设黑客知道完整的路径和文件名。

These bugs are variations on earlier problems reported by Charles McAuley and Michal Zalewski which were fixed in Firefox 2.0.0.4 , as well as an issue reported by hong which was fixed in Firefox 2.0.0.8 .这些漏洞变化问题上较早报道查尔斯McAuley和米哈尔扎莱夫斯基被固定在火狐2.0.0.4版 ，以及作为一个问题报告的红这是固定在 Firefox 2.0.0.8 。
Gregory Fleisher also submitted a series of demonstrations of different ways to lure a user to place focus into the file input control manually.格雷戈里弗莱舍还提出了一系列示威游行不同的方式来吸引用户的地方集中到文件输入控制手动。 These demonstrations included “focus spoofing” by selectively capturing keystrokes and placing the captured characters where the user thinks the focus should be.这些示威列入“重点欺骗”选择性捕获击键并把被俘的字符，用户认为应把重点放在。

References参考文献

• List of Focus shifting bugs 清单漏洞焦点转移
• National Vulnerability Database (NVD) - CVE-2008-0414 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 414

MFSA 2008-01 金融事务局2008-01

Crashes with evidence of memory corruption (rv:1.8.1.12)崩溃的证据的内存腐败（病毒： 1.8.1.12 ）

Descriptions说明

Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox 2.0.0.12 and other Mozilla-based products. Mozilla的开发人员确定和固定的几个稳定的漏洞在浏览器中使用的引擎在Firefox 2.0.0.12和其他基于Mozilla的产品。 Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.其中的一些证据表明崩溃的内存腐败在某些情况下，我们假定有足够的努力，至少其中一些可能被利用来运行任意代码。

Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail.雷鸟股票的浏览器引擎， Firefox和可能遭受的JavaScript ，如果要启用邮件。 This is not the default setting and we strongly discourage users from running JavaScript in mail.这不是默认设置，我们强烈劝阻用户运行邮件中的JavaScript 。 Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript such as large images.如果进一步的调查，我们不能排除这种可能性，对于其中的一些攻击者可以编写存储剥削通过某种手段以外的JavaScript如大型图片。

References参考文献

• List of JavaScript Engine Crashes 清单JavaScript引擎崩溃
• National Vulnerability Database (NVD) - CVE-2008-0413 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 413
• List of Browser Crashes Bugs 列表浏览器崩溃的漏洞
• National Vulnerability Database (NVD) - CVE-2008-0412 国家漏洞数据库（ NVD ） -C VE- 2 008- 0 412

Thunderbird Security Release雷鸟安全释放

Thunderbird 2.0.0.12 is schedule to be release on February 28 .雷鸟的2.0.0.12时间表将公布2月28日。

External Links外部链接

• Download Firefox 2.0.0.12 下载Firefox 2.0.0.12